Quantum Cryptography Based On Bell Inequalities for Three-Dimensional System 
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We present a crytographic protocol based upon entangled qutrit pairs. We analyse the scheme 
under a symmetric incoherent attack and plot the region for which the protocol is secure and compare 
this with the region of violations of certain Bell inequalities. 
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INTRODUCTION 

The need to communicate secretly has always been an 
important issue for military strategists during war time. 
The one-time pad, first proposed by Vernam, has been 
shown to be one of the most secure means of encrypting 
a message provided the key is truly random and the key 
is as long as the message Jj|. However, a major problem 
with the one-time pad is the establishment of a secure 
key between the two physically separated parties with- 
out the services of a courier. Recently, there has been a 
major proposal to apply the laws of quantum mechanics 
to establish this crucial key. This new proposal, called 
Quantum Key Distribution (QKD) protocols, therefore 
involves the use of quantum features such as uncertainty 
principle or quantum correlations to establish a the neces- 
sary key and hence provides unconditionally secure com- 
munication. 

The first Quantum Key Distribution was proposed by 
Bennett and Brassard (BB84) in 1984 based on the fact 
that any measurement on an unknown state of a po- 
larized photon by a third party will always disturb the 
state and hence detectable. An extension of the scheme 
to three-dimensional quantum states has recently been 
done |^| and it was shown to be more secure than two- 
dimensional case. Another well-known variation of QKD 
is based the idea of an entangled pair and detecting the 
presence of the eavesdropper using violations of the Bell- 
Clauser-Horne-Shimony-Holt (Bell-CHSH) inequality [§. 
This protocol (Ekert protocol) is fundamentally interest- 
ing as it provides an example of how a fundamental prob- 
lem in quantum mechanics, namely Bell-CHSH inequal- 
ity and violation of local realism, can be applied to a 
physical problem. Naturally, one questions if it is pos- 
sible to extend this latter protocol involving Bell-CHSH 
inequality to higher dimensional system. 

The extension of Bell-CHSH inequality to higher di- 
mensions is a non-trivial and interesting problem. As 
higher dimensional quantum systems require much less 
entanglement to be non-separable than two-dimensional 
systems (qubits), it was suspected that higher dimen- 
sional entangled systems may lead to stronger violations 



of local realism. These results have been shown numer- 
ically using linear optimization method by searching for 
an underlying local realistic joint probability distribu- 
tion that could reproduce the quantum predictions Q| 
and confirmed analytically |^|, 0]. 

CRYPTOGRAPHIC KEY 

The quantum channel we consider consists of a source 
producing two qutrits 0, which we denote by A and B, 
in the maximally entangled state \tp) = -j= J2k=o \^)a ® 
\k)m where \Ic)a an d \k)s are the fc-th basis state of the 
qutrit A and B respectively (these basis states can repre- 
sent, for instance, spatial degrees of freedom of photons). 
Qutrit A flies towards Alice whereas qutrit B flies to- 
wards Bob. Each observer has at his or her disposal a 
symmetric unbiased six-port beamsplitter. 
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FIG. 1: Qutrit Protocol 

An unbiased symmetric six-port beamsplitter performs 
a unitary transformation between "mutually unbiased" 
bases in the Hilbert space M, 0, ffo|. Such devices were 
tested in several quantum optical experiments 1 1 , 12[ , 



and also various aspects of such devices were analyzed 
theoretically @ Q. 

This quantum optical device has three input and three 
output ports. In front of each input port there is a phase 
shifter. When all the phase shifters are set to zero an 
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incoming photon through one of the input ports has an 
equal chance to leave the device through any of the out- 
put ports. The elements of the unitary transformation, 
which describes its action, are given by 
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where a — e 27 ™/ 3 and the indices k, £ (k,£ = 0, 1, 2) de- 
note the input and exit ports respectively; ipi are the 
phase shifters. These phase shifters can be changed by 
an observer. For convenience, we will denote the val- 
ues of the three phase shifts in the form of a three di- 
mensional vector (p = {tp\, if2, 923). In our protocol both 
observers perform three distinct unitary transformations 
on their qutrits. The transformations at Alice's side are 
defined by the following vectors of phases (pf = (0,0,0), 
$2 = (0)§> — f)> 03 — ( 7r i0j~ 7r ) whereas the transfor- 
mations at Bob's side are defined by <pf = (0, ?), 
tpf = (0, — ^, |), $f = (— 7r, 0, 7r). The observers choose 
their transformations randomly and independently for 
each pair of incoming qutrits. After performing the trans- 



formation defined by the vectors of phases if^,ip^ the 

state reads \ip) mn = Ua^^) ® Ub(0^)\^)- The ob- 
servers perform the measurement of the state of the qutrit 
in the basis in which is defined, that is, \0) x , \l)x> \%)x 
(x = A,B). We have adopted an uncommon but useful 
complex value assignment to the results of the measure- 
ments, first used in namely, for the result of the 
measurement of the ket \k) x we ascribe the value a k . 
This value assignment naturally leads to the following 
definition of the correlation function Q{>p^, <pf) (Qke for 
short) between the values of Alice's and Bob's results of 
measurements [PLlJl 
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where P(a,b;<p£,0f) denotes the probability of obtain- 
ing the result a by Alice and the result b by Bob for the 
respective values of the phase shifts they have used. It 
can be shown that the above correlation function reads 



Qk£ — - 



(3) 
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where, for instance, ip 2 {k) denotes the second component 
of the fc-th vector of phases for Alice. 

Note that Q33 = 1. This means that the results 
of the measurement obtained by Alice and Bob are 
strictly correlated. When Alice obtains the results 
I, a, a 2 Bob must register the results 1, a 2 , a respectively. 
Thus, only the following pairs of the results are pos- 
sible {(1, 1), (a, a 2 ), (a 2 , a)} (denoted subsequently by 
{(0, 0), (1, 2), (2, 1)}) and each pair of correlations occurs 
with the same probability equal to ^. Let us also define 
the following quantity 



S = Im(-a 2 Qn + aQi2 + a 2 Q 2 \ - a 2 Q 2 



(4) 



It can be shown |l5), using the recently discovered Bell 
inequality for two qutrits llfJ], that according to local 
realistic theory S cannot exceed ^/3. However, when us- 
ing the quantum mechanical correlation function (^|), S 
acquires the value |(2 + y/S). Therefore, to violate the 
above Bell inequality in this case one must reduce the cor- 
relation function by the factor 6v/ |~ 9 (such reduction is 
possible by adding the symmetric noise to the system). 
It has been proved (T^| that the above Bell inequality 
gives necessary and sufficient conditions for local realism 
in this case. 

After the transmission has taken place, Alice and Bob 
publicly announce the vectors of phase shifts that they 



have chosen for each particular measurement and divide 
the measurements into two separate groups: a first group 
for which they have used the vectors ipi, 2 an d 0i, $21 
and a second group for which they have used <p% , 0% . 
Subsequently, Alice and Bob announce in public the re- 
sults of the measurements they have obtained but only 
within the first group. In this way they can compute 
the value of S. If this value is not equal to |(2 + v3) 
it means that the qutrits have somehow been disturbed. 
The source of this disturbance can be either an eaves- 
dropper or noise. In case of no disturbance the results 
from the second group allow them, due to the mentioned 
correlations, to generate a ternary cryptographic key. 
For instance when Alice gets the sequence of values, say 
(1, a, 1, a 2 , a 2 , 1, • • ■) then Bob must get the following se- 
quence of results, (1, a 2 , 1, a, a, 1, • ■ •). 



EAVESDROPPING 

Let us consider a symmetric incoherent attack in which 
the eavesdropper (Eve) controls the source that produces 
pairs of qutrits used by Alice and Bob to generate the 
cryptographic key. Naturally, if Eve wants to acquire 
any information about the key, she must introduce some 
disturbance to the state of the qutrits. Her only chance 
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of being undetected is to hide herself behind what, to 
Alice and Bob, may look like an environmental noise in 
the channel. We assume that the noise is symmetrical in 
the sense that the correlation function in the presence of 
it reads 



; (0,V) = FQ(^V), 



(5) 



of generality, we can assume that they are normalized 
(which implies that F + G = 1). Note that the most gen- 
eral state of the joint system of Alice's and Bob's qutrits 
and Eve's ancilla reads J2ki=o \kl)\E k i). However, Eq. (||) 
and the requirement that qab — ^e(\4 ! abe){'4'abe\) 
imposes the following conditions on the states of the an- 
cilla 



where < V < 1. This requirement can only be fulfilled 
if the reduced state for Alice and Bob (after tracing out 
Eve's degrees of freedom) is of the form 

Qab = A\i>) (V>| + B\ X i)(xi I + C\ X i) (X2 \ + (6) 

where the real (not necessarily all positive) numbers A + 
B + C + D = 1, and where the maximally entangled 
orthogonal states \\k) (k = 1,2) read 

1 



\Xi) = ^=(|00)+ a |ll>+a 2 |22)) 



1X2) 
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(|00) +a 2 |ll) +a\22)). 



(7) 



This choice of states stems from the fact that only the 
above states generate correlation functions that are pro- 
portional to Q(<fi,ip). To be more specific, the state \xi) 
gives the correlation function aQ((j), ip) whereas the state 
IX2) gives the correlation function a 2 Q(<f),ip). Thus, if 
we compute the correlation function on the state qab, 
we arrive at the following formula 

Qnoiseifrif) = AQ($,Jj)+aBQ{$,tf)+a 2 CQ($,J) 
= {A + aB + a 2 C)Q{$J). (8) 

From Eq.(||), we obtain the condition A+aB + a 2 C = V, 
which is only possible if B = C (V is real). 

Eve can prepare the reduced density operator (^|) by 
preparing an entangled state of the form, 



Denoting (E kk \E u 
conditions 
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F{E kk \E u )=A-B 

(E kl \E mn ) =S kl ,k^l, (10) 
by A we arrive at the following set of 
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(11) 



Eve's strategy is the following. She prepares the state 
@) , sends the qutrits to Alice and Bob and keeps her an- 
cilla. She then waits for public communication between 
Alice and Bob. When the settings of Alice's and Bob's 
apparatus (phase shifts) are revealed, Eve adopts the fol- 
lowing algorithm: (i) If the chosen settings are not the 
ones used for the key generation she ignores the ancilla; 
(ii) If the settings are the ones for which the key is gen- 
erated, i.e., 03 , (pf, she identifies the ancilla state. 

Let us first find the transformed state in case (ii), i.e., 
the state \^abe) = U A (0f) <g> U B (<fi) <8> I\^abe)- A 
straightforward computation yields 



Habe) = \ab)\E ab ), 



(12) 



a, 6=0 



where the un- normalized states \E a b) read 



Habe) = ;/-(|00)|£ o) 



|ll)|£ n ) + |22)|£2 2 )) 



§(|oi)l^, 



-\02)\E 



2(1/ 



|10)|£ 10 ) + |20)|£ 20 ) 
12)|£ 12 ) + |21)|£ 21 )), 



(9) 



where { | kl) } are the computational basis states of the two 
qutrits, and {\E k i)} are states of ancilla. Without loss 



\E ab ) = l(JLj2 a (*+b)k e *(v£(3)+^m\ Ei 

3 \ V 3 
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+ V 7T E a am+bn e^W+^^\E mn ) (13) 



Note that (12) can also be written more conveniently as 



$abe) = (|00)|£bo) + |12)|£i 2 ) + |21}|£ai>) + (|H)|^n> + |20)|£ 20 ) + \02)\E 02 )) 

+ (|22>|£ 22 ) + |10)|E 10 ) + |01)|£ i>) , (14) 
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where we have grouped the terms into three orthogonal 
subspaces associated with Alice and Bob generating the 
correct key {(0, 0), (1, 2), (2, 1)}, and the two incorrect 
keys, {(1,1), (2,0), (0,2)} or {(2, 2), (1, 0), (0, 1)}. Note 
also that the ancilla states of one subspace are orthogonal 
to the ancilla states of the other subspaces. 




FIG. 2: The optimal three-state discrimination procedure for 
states in the first subspace. The angle between each of the 
states is a = arccos Ai . 

The probability that Eve projects into the sub- 
spaces spanned by the states {|^ 00 ), |F 12 ), |F 21 )}, 
{|£n>, l^20>, |£ 02 )} and {\E 22 ), \E W ), |F 01 )} are 
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(15) 



respectively. We have considered the fact that the states 
within each bracket in Eq. ( [l4| ) have the same norms with 
the same mutual scalar products. Moreover, these scalar 
products are all real. 

Eve now has to determine the state of her ancilla, given 
that Alice and Bob have projected the whole state into 
one of three subspaces associated with the three cases. 
These subspaces are orthogonal so that Eve can, in prin- 
ciple, determine without error, which of these cases Alice 
and Bob have. 

The three ancilla vectors in each subspace correspond- 
ing to the result obtained by Alice and Bob are symmetric 
and equiprobable. This makes Eve's task of discrimina- 
tion easier as this case has an analytic optimal solution 
Q using the so-called "square-root measurement" . We 
define the operator $ = I] Q jF afc ) (F q6 |, where {\E ab )} 
are the ancilla states spanning the subspace associated 
with Alice and Bob's measurement outcomes. Since we 
are discriminating 3 vectors in a 3-dimensional space, the 
optimum measurement directions, \ui a b) = ^^^\E a b) are 
orthogonal, hence Eve simply performs a projective mea- 
surement on her ancilla (Fig. 0). 




FIG. 3: Three Dimensional Plots of the Error Rates 
Thus, Eve's error rate is given by 

3 



(16) 



where Wi, (i = 1, 2, 3) is the probability of correctly iden- 
tifying the three states of the ancilla in the i-th subspace. 
These probabilities are given by 



W,. = 



1^1 + 2^ + ^/ I. -A, 



where 
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(17) 



(18) 



(19) 



Due to the symmetry of the noise introduced by Eve, 
the error rate between Alice and Bob determined using 
Eq.(0) and the conditions in Eq.(0) is 



2(1 - FA) 



(20) 



We also note that whenever Eve eavesdrops, the corre- 
lation function obtained by Alice and Bob is reduced by 
FA. Therefore, if this factor is less than 6v ^~ 9 , the Bell 
inequality is not violated jf| and so Alice and Bob will 
abort the protocol. This implies that Eve must keep this 
factor above this value. 

Fig.|| shows the three dimensional plots of the error 
rates of Eve as a function of the parameters F and A 
(labeled by surface I) as well as the error rate between 
Alice and Bob (labeled by surface II). The region in which 
the factor FA is greater than the threshold value (Vq — 
(6^3— 9)/2) is demarcated by the "wall" labeled C. In 
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the region bounded by FA > Vo, the error rate of Eve 
is always greater than the error rate between Alice and 
Bob. 

An alternative approach to test the security of the pro- 
tocol against such incoherent symmetric attack is to con- 



sider the mutual information between Alice and Eve and 
compare it with the mutual information between Alice 
and Bob. The mutual information between Alice and 
Eve is given by the following expression 



F AE = H(A)+H(E)-H(A;E) 

= log3-3(Foo|Foo)log(F 00 |Foo) -e^nl^Olog^nlFn) 

- 3(E 00 \E 00 )W 1 log ((F 00 |Foo>Wi) - 6(F 00 |F 00 )(1 - W x f log ((F 00 |F 00 )(1 - W x f) 
-%{E XX \E XX )W % log ({E XX \E XX )W^ - 12( J B U |F 11 )(1 - W 2 f log ((FnlFnHl - PK 2 ) 2 ) , (21) 
where H is the Shannon entropy. The mutual information between Alice and Bob is 

F AE = 2 log 3 + J (1 + FA) {log (1 + FA) - log 9} + | (1 - FA) {log (1 - FA) - log 9} . (22) 



r 



Fig. [| shows the plan elevation of the 3-dimensional plots 
of the mutual information as a function of the parameters 
F and A. The line of intersection between F^E an( i ^AB 
clearly lies behind the wall separating the region in which 
the Bell inequality is violated from the region (Fl) in 
which local realistic description is possible (F2). In the 
region Fl, F^g > I^E- F rom numerical calculation, the 
maximum value of V for which Eve's mutual information 
equals Alice and Bob's is 0.6629. Thus, Alice and Bob 
have a buffer region in which to operate securely from 
this kind of attack by Eve. 

To summarize, we have presented a cryptographic pro- 
tocol using qutrits which is resistant to a form of sym- 
metric, incoherent attacks. The qutrit Bell inequality 
provides a sufficient condition for secure communication. 
However, this attack may not be optimal so the Bell in- 
equality may prove to be necessary. 

D.K., C.H. Oh and L.C.K. acknowledge financial sup- 
port provided under the ASTAR Grant No. 012-104- 
0040. D.K.L.O acknowledges the support of CESG (UK) 
and QAIP grant IST-1999-11234. 



Mutual Information 1 




FIG. 4: Plan elevation of 3-dimensional plot of mutual infor- 
mation between Alice-Bob and Alice-Eve. 
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